rspamd/rspamd-dqs/3.x/rbl_group.conf

symbols = {
   "RECEIVED_SPAMHAUS_SBL" {
        weight = 6.0;
        }
    "RECEIVED_SPAMHAUS_CSS" {
        weight = 3.0;
        }
    "RECEIVED_SPAMHAUS_XBL" {
        weight = 0;
        }
    "SPAMHAUS_ZEN" {
        weight = 7.0;
        }
    "SH_AUTHBL_RECEIVED" {
        weight = 4.0;
        }
    "RBL_DBL_SPAM" {
        weight = 7.0;
        }
    "RBL_DBL_PHISH" {
        weight = 7.0;
        }
    "RBL_DBL_MALWARE" {
        weight = 7.0;
        }
    "RBL_DBL_BOTNET" {
        weight = 7.0;
        }
    "RBL_DBL_ABUSED_SPAM" {
        weight = 3.0;
        }
    "RBL_DBL_ABUSED_PHISH" {
        weight = 3.0;
        }
    "RBL_DBL_ABUSED_MALWARE" {
        weight = 3.0;
        }
    "RBL_DBL_ABUSED_BOTNET" {
        weight = 3.0;
        }
    "RBL_ZRD_VERY_FRESH_DOMAIN" {
        weight = 7.0;
        }
    "RBL_ZRD_FRESH_DOMAIN" {
        weight = 4.0;
        }
    "ZRD_VERY_FRESH_DOMAIN" {
        weight = 7.0;
        }
    "ZRD_FRESH_DOMAIN" {
        weight = 4.0;
        }
    "SH_EMAIL_DBL" {
        weight = 7.0;
        }
    "SH_EMAIL_DBL_ABUSED" {
        weight = 7.0;
        }
    "SH_EMAIL_ZRD_VERY_FRESH_DOMAIN" {
        weight = 7.0;
        }
    "SH_EMAIL_ZRD_FRESH_DOMAIN" {
        weight = 4.0;
        }
    "RBL_DBL_DONT_QUERY_IPS" {
        weight = 0.0;
        }
    "RBL_ZRD_DONT_QUERY_IPS" {
        weight = 0.0;
        }
    "SH_EMAIL_ZRD_DONT_QUERY_IPS" {
        weight = 0.0;
        }
    "SH_EMAIL_DBL_DONT_QUERY_IPS" {
        weight = 0.0;
        }
    "DBL" {
        weight = 0.0;
        description = "DBL unknown result";
        groups = ["spamhaus"];
    }
    "DBL_SPAM" {
        weight = 7;
        description = "DBL uribl spam";
        groups = ["spamhaus"];
    }
    "DBL_PHISH" {
        weight = 7;
        description = "DBL uribl phishing";
        groups = ["spamhaus"];
    }
    "DBL_MALWARE" {
        weight = 7;
        description = "DBL uribl malware";
        groups = ["spamhaus"];
    }
    "DBL_BOTNET" {
        weight = 7;
        description = "DBL uribl botnet C&C domain";
        groups = ["spamhaus"];
    }


    "DBLABUSED_SPAM_FULLURLS" {
        weight = 5.5;
        description = "DBL uribl abused legit spam";
        groups = ["spamhaus"];
    }
    "DBLABUSED_PHISH_FULLURLS" {
        weight = 5.5;
        description = "DBL uribl abused legit phish";
        groups = ["spamhaus"];
    }
    "DBLABUSED_MALWARE_FULLURLS" {
        weight = 5.5;
        description = "DBL uribl abused legit malware";
        groups = ["spamhaus"];
    }
    "DBLABUSED_BOTNET_FULLURLS" {
        weight = 5.5;
        description = "DBL uribl abused legit botnet";
        groups = ["spamhaus"];
    }


    "DBL_ABUSE" {
        weight = 5.5;
        description = "DBL uribl abused legit spam";
        groups = ["spamhaus"];
    }
    "DBL_ABUSE_REDIR" {
        weight = 1.5;
        description = "DBL uribl abused spammed redirector domain";
        groups = ["spamhaus"];
    }
    "DBL_ABUSE_PHISH" {
        weight = 5.5;
        description = "DBL uribl abused legit phish";
        groups = ["spamhaus"];
    }
    "DBL_ABUSE_MALWARE" {
        weight = 5.5;
        description = "DBL uribl abused legit malware";
        groups = ["spamhaus"];
    }
    "DBL_ABUSE_BOTNET" {
        weight = 5.5;
        description = "DBL uribl abused legit botnet C&C";
        groups = ["spamhaus"];
    }
    "DBL_PROHIBIT" {
        weight = 0.0;
        description = "DBL uribl IP queries prohibited!";
        groups = ["spamhaus"];
    }
    "DBL_BLOCKED_OPENRESOLVER" {
      weight = 0.0;
      description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
      groups = ["spamhaus"];
    }
    "DBL_BLOCKED" {
      weight = 0.0;
      description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
      groups = ["spamhaus"];
    }
    "SPAMHAUS_ZEN_URIBL" {
        weight = 0.0;
        description = "Spamhaus ZEN URIBL: Filtered result";
        groups = ["spamhaus"];
    }
    "URIBL_SBL" {
        weight = 6.5;
        description = "A domain in the message body resolves to an IP listed in Spamhaus SBL";
        one_shot = true;
        groups = ["spamhaus"];
    }
    "URIBL_SBL_CSS" {
       weight = 6.5;
        description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS";
        one_shot = true;
        groups = ["spamhaus"];
    }
    "URIBL_PBL" {
        weight = 0.01;
        description = "A domain in the message body resolves to an IP listed in Spamhaus PBL";
        one_shot = true;
        groups = ["spamhaus"];
    }
    "URIBL_DROP" {
        weight = 6.5;
        description = "A domain in the message body resolves to an IP listed in Spamhaus DROP";
        one_shot = true;
        groups = ["spamhaus"];
    }
    "URIBL_XBL" {
        weight = 5.0;
        description = "A domain in the message body resolves to an IP listed in Spamhaus XBL";
        one_shot = true;
        groups = ["spamhaus"];
    }
    "SPAMHAUS_SBL_URL" {
        weight = 6.5;
        description = "A numeric URL in the message body is listed in Spamhaus SBL";
        one_shot = true;
        groups = ["spamhaus"];
    }
    .include(try=true,priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/sh_rbl_group_hbl.conf"
}